@produtype/core 1.8.2 → 1.9.1

package/dist/analyzer/detectBilling.js

@@ -55,7 +55,9 @@ async function detectBilling(ctx) {
         /stripeSubscriptionId/i,
         /\/webhooks?\/stripe/i,
         /\/stripe\/webhooks?/i,
-    ], 30)).filter((hit) => !LARAVEL_SERVICE_SLOTS.test(hit.file));
+    ], 30, 
+    /** The budget counts real signals, not entries in Laravel's table of slots. */
+    (match) => !LARAVEL_SERVICE_SLOTS.test(match.file)));
     /**
      * The processor, declared wherever this project declares its dependencies.
      *

package/dist/analyzer/detectDocker.js

@@ -3,10 +3,33 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectDocker = detectDocker;
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
 const absenceEvidence_1 = require("./absenceEvidence");
+/**
+ * The container the editor opens is not the container the product ships in.
+ *
+ * `.devcontainer/` is the Development Containers convention — VS Code, Codespaces and
+ * anything else that implements containers.dev read it to build the environment a
+ * *contributor* works in. n8n has one, and it sorted ahead of
+ * `docker/images/n8n/Dockerfile`, so the report answered "how does this ship" with the
+ * development environment: the wrong file cited, and the HEALTHCHECK question asked of
+ * a Dockerfile that has no reason to answer it.
+ *
+ * The first match in path order decided before, which is no decision at all. The
+ * shallowest of the real ones is the project's own, the same tie-break the package
+ * manager uses.
+ *
+ * A repository whose only container definition is its devcontainer keeps it rather
+ * than losing the answer: nothing that used to resolve stops resolving.
+ */
+const DEVELOPMENT_CONTAINER = /(^|\/)\.devcontainer\//;
+function theShippedOne(candidates) {
+    const shipped = candidates.filter((file) => !DEVELOPMENT_CONTAINER.test(file));
+    const pool = shipped.length > 0 ? shipped : candidates;
+    return pool.reduce((best, file) => (best === undefined || file.split('/').length < best.split('/').length ? file : best), undefined);
+}
 async function detectDocker(ctx) {
     const evidence = [];
-    const dockerfile = ctx.files.all.find((f) => /(^|\/)Dockerfile$/.test(f));
-    const composeFile = ctx.files.all.find((f) => /(^|\/)(docker-compose\.ya?ml|compose\.ya?ml)$/.test(f));
+    const dockerfile = theShippedOne(ctx.files.all.filter((f) => /(^|\/)Dockerfile$/.test(f)));
+    const composeFile = theShippedOne(ctx.files.all.filter((f) => /(^|\/)(docker-compose\.ya?ml|compose\.ya?ml)$/.test(f)));
     let hasHealthcheck = false;
     let hasExpose = false;
     let services = [];

package/dist/analyzer/detectSecurity.js

@@ -11,6 +11,10 @@ const readingDepth_1 = require("./readingDepth");
 const developmentOnly_1 = require("./developmentOnly");
 /** Lines that decide which origins may call this server. */
 const ORIGIN_HANDLING = [/Access-Control-Allow-Origin/i, /ALLOWED_ORIGINS/, /allowedOrigins/i];
+/** A header name used as a key into a headers object: a lookup, not a decision. */
+const READS_A_HEADER = /\[\s*(['"`])[^'"`]+\1\s*\](?!\s*=[^=])/;
+/** The calls that put one on a response, in the frameworks this reads. */
+const SETS_A_HEADER = /put_resp_header|setHeader|set_header|add_header|headers\.(?:set|append)|writeHead/i;
 /** The cloud SDKs' names for a bucket's own cross-origin rules. */
 const CLOUD_STORAGE_CORS = /\bStorageCorsRule\b|\bCorsRules\b|\bCORSRule\b|\bCORSConfiguration\b|\bsetCorsConfiguration\b/;
 /**
@@ -227,7 +231,12 @@ async function detectSecurity(ctx) {
          */
         /config\.content_security_policy\b/,
         /^\s*config\.force_ssl\s*=\s*true/m,
-    ], 20);
+    ], 20, 
+    /**
+     * The filter runs inside the search, so the budget is spent on lines that set a
+     * header rather than on lines that merely name one — see the rule below.
+     */
+    (match) => !READS_A_HEADER.test(match.snippet) || SETS_A_HEADER.test(match.snippet));
     /**
      * Reading a header is not setting one.
      *
@@ -242,9 +251,6 @@ async function detectSecurity(ctx) {
      * `headers.set`, `add_header` — or an assignment to that subscript, and a line doing
      * either is left alone.
      */
-    const READS_A_HEADER = /\[\s*(['"`])[^'"`]+\1\s*\](?!\s*=[^=])/;
-    const SETS_A_HEADER = /put_resp_header|setHeader|set_header|add_header|headers\.(?:set|append)|writeHead/i;
-    const headerSignalsThatSet = headerSignals.filter((hit) => !READS_A_HEADER.test(hit.snippet) || SETS_A_HEADER.test(hit.snippet));
     /**
      * Spring Security, which writes the headers without being asked.
      *
@@ -283,7 +289,7 @@ async function detectSecurity(ctx) {
             claim: 'headers',
         });
     }
-    const helmet = helmetDep || headerSignalsThatSet.length > 0 || springFilterChain.length > 0;
+    const helmet = helmetDep || headerSignals.length > 0 || springFilterChain.length > 0;
     /**
      * The packages the ecosystem names, as distinct from the variables authors do.
      * Shared between the dependency check below and the binding walk further down.
@@ -381,7 +387,9 @@ async function detectSecurity(ctx) {
         /HttpStatus\.TOO_MANY_REQUESTS/,
         /HttpStatusCode\.TooManyRequests/,
         /Status429TooManyRequests/,
-    ], 20);
+    ], 20, 
+    /** The budget counts refusals issued, not 429s this project received. */
+    (match) => !COMPARES_A_STATUS.test(match.snippet));
     /**
      * Still issuing, not receiving — the constants need the same test the numbers got.
      *
@@ -390,7 +398,7 @@ async function detectSecurity(ctx) {
      * refused by somebody else's, which is what nocodb's webhook invoker does. A
      * comparison is the reading direction; an argument is the writing one.
      */
-    const issuedRateLimits = rateLimitSignals.filter((hit) => !COMPARES_A_STATUS.test(hit.snippet));
+    const issuedRateLimits = rateLimitSignals;
     const rateLimit = rateLimitDep || issuedRateLimits.length > 0;
     /**
      * Rate limiting where the brute force happens.
@@ -414,8 +422,27 @@ async function detectSecurity(ctx) {
      * structural reader here keeps.
      */
     const boundLimiterUses = await (0, valuesFromPackage_1.readPackageValueUses)(ctx.root, source, RATE_LIMIT_PACKAGES);
-    const authSurfaceFiles = new Set((await (0, textSearch_1.searchInFiles)(ctx.root, source, [/['"`]\/(login|signin|sign-in|auth|session)/i, /passport\./, /signIn\s*\(/, /authenticate\s*\(/], 40))
-        .map((match) => match.file));
+    /**
+     * One budget per pattern, because a noisy one was spending the whole thing.
+     *
+     * These four searches ran as one with a cap of forty matches, and the cap decided
+     * the answer. n8n ships about four hundred `*.credentials.ts` files describing how
+     * to authenticate to *other people's* APIs — Airtop, Action Network, Microsoft — and
+     * they sort ahead of `packages/cli/src/controllers/auth.controller.ts`. Thirty-eight
+     * files of third-party credential definitions filled the budget, n8n's own sign-in
+     * controller never entered the set, and its login — throttled by IP and by email —
+     * was reported unprotected.
+     *
+     * A cap is there to bound work, and it had come to decide which files are this
+     * project's authentication surface. Per pattern, the decisive search keeps its own
+     * budget however much noise the others find.
+     */
+    const AUTH_SURFACE_PATTERNS = [/['"`]\/(login|signin|sign-in|auth|session)/i, /passport\./, /signIn\s*\(/, /authenticate\s*\(/];
+    const authSurfaceFiles = new Set();
+    for (const pattern of AUTH_SURFACE_PATTERNS) {
+        for (const match of await (0, textSearch_1.searchInFiles)(ctx.root, source, [pattern], 40))
+            authSurfaceFiles.add(match.file);
+    }
     /**
      * A limiter mounted on a prefix covers what is mounted under it.
      *
@@ -433,14 +460,56 @@ async function detectSecurity(ctx) {
         .map((match) => /\buse\(\s*['"`](\/[^'"`]*)['"`]/.exec(match.snippet)?.[1])
         .filter((path) => Boolean(path));
     const coversAnAuthMount = mountedPaths.some((prefix) => authMountPaths.some((mount) => mount === prefix || mount.startsWith(`${prefix}/`)));
+    /**
+     * The limit declared in the route's own options.
+     *
+     * n8n writes `@Post('/login', { ipRateLimit: {...}, keyedRateLimit:
+     * createBodyKeyedRateLimiter(...) })` and applies both in its controller registry.
+     * Nothing in that file imports `express-rate-limit` — a service does — and nothing
+     * in it issues a 429, because the package does that. So a login throttled by IP and
+     * by email came back `partial`, cited on a Discord node's type guard for somebody
+     * else's 429.
+     *
+     * The word `rateLimit` alone is what dokploy taught us not to trust: its
+     * `rateLimitEnabled: z.boolean().optional()` is a field in a form schema. What makes
+     * this different is where the word sits — inside the declaration of a route whose
+     * path is a sign-in path, within a few lines of it — and that the project declares a
+     * limiter package at all. A schema field is neither.
+     */
+    const AUTH_ROUTE_DECLARATION = /['"`]\/(?:login|signin|sign-in|sessions?|auth\/login)['"`]/i;
+    const LIMIT_IN_ROUTE_OPTIONS = /rate[_-]?limit|throttle/i;
+    const ROUTE_OPTIONS_WINDOW = 8;
+    const limitedAuthRoutes = [];
+    if (rateLimitDep) {
+        for (const file of authSurfaceFiles) {
+            const text = await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file);
+            if (!text)
+                continue;
+            const lines = text.split(/\r?\n/);
+            for (let i = 0; i < lines.length; i++) {
+                if (!AUTH_ROUTE_DECLARATION.test(lines[i]))
+                    continue;
+                const window = lines.slice(i + 1, i + 1 + ROUTE_OPTIONS_WINDOW);
+                const offset = window.findIndex((line) => LIMIT_IN_ROUTE_OPTIONS.test(line));
+                if (offset === -1)
+                    continue;
+                limitedAuthRoutes.push({ file, line: i + 2 + offset, snippet: window[offset].trim().slice(0, 200) });
+                break;
+            }
+        }
+    }
+    for (const hit of limitedAuthRoutes.slice(0, 3)) {
+        evidence.push({ type: 'snippet', value: hit.snippet, file: hit.file, line: hit.line, claim: 'rate-limit' });
+    }
     const rateLimitNearAuth = coversAnAuthMount
+        || limitedAuthRoutes.length > 0
         || (boundLimiterUses ?? []).some((use) => authSurfaceFiles.has(use.file))
         || issuedRateLimits.some((match) => authSurfaceFiles.has(match.file));
     if (helmetDep)
         evidence.push({ type: 'dependency', value: 'helmet', claim: 'headers' });
     if (rateLimitDep)
         evidence.push({ type: 'dependency', value: 'rate limiting package', claim: 'rate-limit' });
-    for (const m of headerSignalsThatSet)
+    for (const m of headerSignals)
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'headers' });
     for (const m of issuedRateLimits)
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'rate-limit' });

package/dist/utils/fileScanner.js

@@ -167,7 +167,21 @@ async function scanFiles(opts) {
         ignore,
         suppressErrors: true,
     });
-    return withoutVirtualenvs(entries.map((e) => e.split(path.sep).join('/')));
+    /**
+     * Sorted, because every search below has a cap and the cap counts in this order.
+     *
+     * fast-glob returns what the filesystem hands it, which is the directory entry order
+     * on that machine. Every detector here reads the first N matches and stops, so the
+     * same repository could be read differently on two computers, or after a fresh clone
+     * — in a tool whose first word is "deterministic".
+     *
+     * It was found in n8n, where the four searches that decide a project's
+     * authentication surface filled their budget with third-party credential
+     * definitions and never reached `auth.controller.ts`. Which files won that race was
+     * nobody's decision. Sorting does not make the budget large enough; it makes the
+     * answer the same every time, which is the part that was promised.
+     */
+    return withoutVirtualenvs(entries.map((e) => e.split(path.sep).join('/'))).sort();
 }
 /**
  * Quick check: does at least one path matching glob exist?

package/dist/utils/textSearch.d.ts

@@ -28,5 +28,19 @@ export declare function matchLines(text: string, needles: Array<string | RegExp>
  * Search a list of relative file paths for any of the given needles
  * (string or RegExp). Returns at most `limit` matches.
  */
-export declare function searchInFiles(root: string, files: string[], needles: Array<string | RegExp>, limit?: number): Promise<TextMatch[]>;
+/**
+ * A budget counts answers, not candidates.
+ *
+ * Several detectors search with a cap and then filter what came back — the header
+ * search drops lines that *read* a header rather than set one, the rate-limit search
+ * drops a 429 this project received rather than issued. The cap was spent on the
+ * candidates, so a repository with enough noise never handed the filter anything to
+ * keep: seventy files reading `content-security-policy` filled a budget of twenty,
+ * and the file setting one was never opened.
+ *
+ * Giving the filter to the search fixes it at the root. `keep` runs per match, and
+ * only a match it keeps costs budget, so the limit means what it says — "up to this
+ * many findings" — rather than "up to this many lines that might have been findings".
+ */
+export declare function searchInFiles(root: string, files: string[], needles: Array<string | RegExp>, limit?: number, keep?: (match: TextMatch) => boolean): Promise<TextMatch[]>;
 export declare function anyIncludes(haystack: string, needles: string[]): boolean;

package/dist/utils/textSearch.js

@@ -137,7 +137,21 @@ function matchLines(text, needles, file = '') {
  * Search a list of relative file paths for any of the given needles
  * (string or RegExp). Returns at most `limit` matches.
  */
-async function searchInFiles(root, files, needles, limit = 25) {
+/**
+ * A budget counts answers, not candidates.
+ *
+ * Several detectors search with a cap and then filter what came back — the header
+ * search drops lines that *read* a header rather than set one, the rate-limit search
+ * drops a 429 this project received rather than issued. The cap was spent on the
+ * candidates, so a repository with enough noise never handed the filter anything to
+ * keep: seventy files reading `content-security-policy` filled a budget of twenty,
+ * and the file setting one was never opened.
+ *
+ * Giving the filter to the search fixes it at the root. `keep` runs per match, and
+ * only a match it keeps costs budget, so the limit means what it says — "up to this
+ * many findings" — rather than "up to this many lines that might have been findings".
+ */
+async function searchInFiles(root, files, needles, limit = 25, keep) {
     const matches = [];
     for (const file of files) {
         if (matches.length >= limit)
@@ -160,7 +174,9 @@ async function searchInFiles(root, files, needles, limit = 25) {
             for (const n of needles) {
                 const hit = typeof n === 'string' ? line.includes(n) : n.test(line);
                 if (hit) {
-                    matches.push({ file, line: i + 1, snippet: line.trim().slice(0, 200) });
+                    const match = { file, line: i + 1, snippet: line.trim().slice(0, 200) };
+                    if (!keep || keep(match))
+                        matches.push(match);
                     break;
                 }
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.8.2",
+  "version": "1.9.1",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {